Entity.SignIdentity used the wrong signature function and produced invalid certification signatures. Fixed. VerifyUserIdSignature was used for checking the self-signature on an identity, but didn't support anything but a self-signature. This change alters the low-level API so that checking cross-signatures is possible. Fixes golang/go#7371. LGTM=bradfitz R=bradfitz CC=golang-codereviews https://golang.org/cl/96240043